These works all use the differential privacy (DP) privacy metric, with two variations coming closest to our setting. As summarized in [1]}, a bandit algorithm is (globally) \(\epsilon \) -DP if \(\log q_\phi (\tau _a|\tau _x) - \log q_\phi (\tau _a|\tau _{x}^{\prime }) \le \epsilon \)  for all \(\tau _a\)  and \(\tau _x, \tau _x^{\prime }\)  where \(\tau _{x}^{\prime }\)  is a trajectory that differs from \(\tau _x\)  at only one timestep.
An algorithm is locally \(\epsilon \) -DP if this holds for a single timestep, i.e. \(\log q_\phi (a_t|\tau _{x_{1:t-1}}, \tau _{a_{1:t-1}}) - \log q_\phi (a_t|\tau _{x_{1:t-1}}^{\prime }, \tau _{a_{1:t-1}})\) , for all \(\tau _a\)  and \(\tau _{x_{1:t-1}}, \tau _{x_{1:t-1}}^{\prime }\)  where \(\tau _{x_{1:t-1}}^{\prime }\)  is a trajectory that differs from \(\tau _{x_{1:t-1}}\)  at only one timestep.
